@camstack/system 1.2.458 → 1.2.459

package/dist/{restore-archive-C7kLDI_0.mjs → restore-archive-CmP-iiG9.mjs}

@@ -1,5 +1,4 @@
-import { Ki as defineRecordKinds, N as DataStoreDatabaseSchema, S as DATABASE_SNAPSHOT_SUFFIX } from "./dist-B_GRPhnY.mjs";
-import { t as require_read_all_rows } from "./read-all-rows-TaPqdWNF.mjs";
+import { Gi as defineRecordKinds, N as DataStoreDatabaseSchema, S as DATABASE_SNAPSHOT_SUFFIX } from "./dist-Wy8cTxg6.mjs";
 import { z } from "zod";
 import { createCipheriv, createDecipheriv, createHash, createPrivateKey, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync, randomBytes } from "node:crypto";
 import { Buffer as Buffer$1 } from "buffer";
@@ -21,6 +20,88 @@ import $r, { EventEmitter as EventEmitter$1 } from "events";
 import * as zlib from "node:zlib";
 import { pipeline } from "node:stream/promises";
 import no from "node:assert";
+var BackupScheduleBodySchema = z.object({
+	label: z.string(),
+	cron: z.string(),
+	enabled: z.boolean(),
+	locationIds: z.array(z.string()).readonly(),
+	retentionCount: z.number(),
+	dataSources: z.array(z.string()).readonly().optional(),
+	databases: z.array(DataStoreDatabaseSchema).readonly().optional(),
+	lastAttemptAt: z.number().optional(),
+	lastSuccessAt: z.number().optional(),
+	lastError: z.string().optional()
+});
+var BackupDestinationPolicyBodySchema = z.object({
+	enabled: z.boolean(),
+	retentionCount: z.number(),
+	label: z.string().optional(),
+	lastAttemptAt: z.number().optional(),
+	lastError: z.string().optional()
+});
+var BackupEncryptionKeyBodySchema = z.object({
+	keyId: z.string(),
+	publicKey: z.string(),
+	createdAt: z.number(),
+	retiredAt: z.number().nullable()
+});
+var BackupSeedMarkerBodySchema = z.object({ seededAt: z.number() });
+var _backupOrchestratorRecordKinds = defineRecordKinds({
+	schedules: {
+		schema: BackupScheduleBodySchema,
+		class: "config",
+		writeTrigger: "operator upsert/delete; orchestrator stamps lastAttempt/success/error",
+		device: "none",
+		at: "none",
+		indexes: [{
+			name: "enabled",
+			fields: ["enabled"]
+		}],
+		retention: { none: "operator delete only" },
+		entry: {
+			title: "Backup schedules",
+			nameField: "label"
+		}
+	},
+	"destination-policies": {
+		schema: BackupDestinationPolicyBodySchema,
+		class: "config",
+		writeTrigger: "ensureDefault, operator upsert, recordAttempt after each archive write",
+		device: "none",
+		at: "none",
+		retention: { none: "row outlives location; ensureDefault recreates" }
+	},
+	"encryption-keys": {
+		schema: BackupEncryptionKeyBodySchema,
+		class: "config",
+		writeTrigger: "setupEncryption activate; disableEncryption retires active row",
+		device: "none",
+		at: "none",
+		retention: { none: "retired keys kept for archive decryption hints" }
+	},
+	"seed-markers": {
+		schema: BackupSeedMarkerBodySchema,
+		class: "config",
+		writeTrigger: "mark() once per seed id after seed landed",
+		device: "none",
+		at: "none",
+		retention: { none: "one row per seed id ever" }
+	}
+});
+var backupOrchestratorRecordKinds = _backupOrchestratorRecordKinds;
+var backupSchedulesRecordKind = _backupOrchestratorRecordKinds.schedules;
+var backupDestinationPoliciesRecordKind = _backupOrchestratorRecordKinds["destination-policies"];
+var backupEncryptionKeysRecordKind = _backupOrchestratorRecordKinds["encryption-keys"];
+var backupSeedMarkersRecordKind = _backupOrchestratorRecordKinds["seed-markers"];
+function backupRecordStoresOf(records) {
+	return {
+		schedules: records.kind(backupSchedulesRecordKind),
+		destinationPolicies: records.kind(backupDestinationPoliciesRecordKind),
+		encryptionKeys: records.kind(backupEncryptionKeysRecordKind),
+		seedMarkers: records.kind(backupSeedMarkersRecordKind)
+	};
+}
+//#endregion
 //#region src/builtins/system-backup/backup-encryption.ts
 /**
 * Backup archive encryption — public key, streaming, chunked AEAD (D-backup
@@ -385,334 +466,6 @@ async function decryptBackupFile(input, output, secretKey) {
 	}
 }
 //#endregion
-//#region src/builtins/backup-orchestrator/encryption-key-store.ts
-var import_read_all_rows = require_read_all_rows();
-/**
-* @durable class=config owner=backup-orchestrator
-*   write="`setupEncryption` inserts one row per generated key and retires the
-*     previous active row; `disableEncryption` retires the active row"
-*   retention="none — one small row per key ever generated; a retired row
-*     names the key older archives need"
-*/
-var BACKUP_ENCRYPTION_KEYS_COLLECTION = "backup_encryption_keys";
-var COLUMNS$1 = [
-	{
-		name: "key_id",
-		type: "TEXT",
-		primaryKey: true
-	},
-	{
-		name: "public_key",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "created_at",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "retired_at",
-		type: "INTEGER"
-	}
-];
-var BackupEncryptionKeyStore = class {
-	store;
-	now;
-	declared = false;
-	keysKind;
-	constructor(store, now = Date.now, keysKind = null) {
-		this.store = store;
-		this.now = now;
-		this.keysKind = keysKind;
-	}
-	async ensureDeclared() {
-		if (this.keysKind !== null) return;
-		if (this.declared) return;
-		await this.store.declareCollection({
-			collection: BACKUP_ENCRYPTION_KEYS_COLLECTION,
-			columns: COLUMNS$1
-		});
-		this.declared = true;
-	}
-	/** Every key, newest first. */
-	async list() {
-		await this.ensureDeclared();
-		const kind = this.keysKind;
-		if (kind !== null) {
-			const rows = await (0, import_read_all_rows.readAllRows)(kind);
-			rows.sort((a, b) => b.data.createdAt - a.data.createdAt);
-			const out = [];
-			for (const row of rows) {
-				const record = bodyToRecord(row.id, row.data);
-				if (record !== null) out.push(record);
-			}
-			return out;
-		}
-		const rows = await this.store.query({
-			collection: BACKUP_ENCRYPTION_KEYS_COLLECTION,
-			filter: { orderBy: {
-				field: "created_at",
-				direction: "desc"
-			} }
-		});
-		const out = [];
-		for (const row of rows) {
-			const record = toRecord(row.data);
-			if (record !== null) out.push(record);
-		}
-		return out;
-	}
-	/** The key new archives are encrypted to; `null` = encryption off. */
-	async active() {
-		return (await this.list()).find((k) => k.retiredAt === null) ?? null;
-	}
-	/** Make `publicKey` the active key; the previous one is retired, kept listed. */
-	async activate(input) {
-		const parsed = parseBackupPublicKey(input.publicKey);
-		const t = this.now();
-		await this.retireActive(t);
-		const record = {
-			keyId: parsed.keyId,
-			publicKey: input.publicKey.trim(),
-			createdAt: t,
-			retiredAt: null
-		};
-		await this.write(record);
-		return record;
-	}
-	/** Encryption off: the active key is retired. Archives already made keep needing it. */
-	async disable() {
-		await this.retireActive(this.now());
-	}
-	async retireActive(at) {
-		for (const key of await this.list()) if (key.retiredAt === null) await this.write({
-			...key,
-			retiredAt: at
-		});
-	}
-	async write(record) {
-		await this.ensureDeclared();
-		const kind = this.keysKind;
-		if (kind !== null) {
-			const body = {
-				keyId: record.keyId,
-				publicKey: record.publicKey,
-				createdAt: record.createdAt,
-				retiredAt: record.retiredAt
-			};
-			const data = backupOrchestratorRecordKinds["encryption-keys"].schema.parse(body);
-			await kind.put({
-				id: record.keyId,
-				data
-			});
-			return;
-		}
-		await this.store.deleteWhere({
-			collection: BACKUP_ENCRYPTION_KEYS_COLLECTION,
-			filter: { where: { key_id: record.keyId } }
-		});
-		await this.store.insert({
-			collection: BACKUP_ENCRYPTION_KEYS_COLLECTION,
-			record: {
-				id: record.keyId,
-				data: {
-					key_id: record.keyId,
-					public_key: record.publicKey,
-					created_at: record.createdAt,
-					retired_at: record.retiredAt
-				}
-			}
-		});
-	}
-};
-function bodyToRecord(keyId, body) {
-	if (!keyId) return null;
-	return {
-		keyId: body.keyId,
-		publicKey: body.publicKey,
-		createdAt: body.createdAt,
-		retiredAt: body.retiredAt
-	};
-}
-function toRecord(row) {
-	const keyId = row["key_id"];
-	const publicKey = row["public_key"];
-	const createdAt = row["created_at"];
-	if (typeof keyId !== "string" || typeof publicKey !== "string") return null;
-	const retired = row["retired_at"];
-	return {
-		keyId,
-		publicKey,
-		createdAt: typeof createdAt === "number" ? createdAt : Number(createdAt ?? 0),
-		retiredAt: typeof retired === "number" ? retired : null
-	};
-}
-//#endregion
-//#region src/builtins/backup-orchestrator/seed-marker-store.ts
-/**
-* @durable class=config owner=backup-orchestrator
-*   write="the orchestrator inserts one row per seed id the first time that
-*     seed is created (or found already created); never updated"
-*   retention="none — one tiny row per seed ever made; deleting it lets the
-*     seed be re-created once more on the next boot"
-*/
-var BACKUP_SEED_MARKERS_COLLECTION = "backup_seed_markers";
-var COLUMNS = [{
-	name: "seed_id",
-	type: "TEXT",
-	primaryKey: true
-}, {
-	name: "seeded_at",
-	type: "INTEGER",
-	notNull: true
-}];
-var BackupSeedMarkerStore = class {
-	store;
-	now;
-	declared = false;
-	markersKind;
-	constructor(store, now = Date.now, markersKind = null) {
-		this.store = store;
-		this.now = now;
-		this.markersKind = markersKind;
-	}
-	async ensureDeclared() {
-		if (this.markersKind !== null) return;
-		if (this.declared) return;
-		await this.store.declareCollection({
-			collection: BACKUP_SEED_MARKERS_COLLECTION,
-			columns: COLUMNS
-		});
-		this.declared = true;
-	}
-	async has(seedId) {
-		await this.ensureDeclared();
-		const kind = this.markersKind;
-		if (kind !== null) return await kind.get(seedId) !== null;
-		return (await this.store.query({
-			collection: BACKUP_SEED_MARKERS_COLLECTION,
-			filter: {
-				where: { seed_id: seedId },
-				limit: 1
-			}
-		})).length > 0;
-	}
-	async mark(seedId) {
-		await this.ensureDeclared();
-		if (await this.has(seedId)) return;
-		const kind = this.markersKind;
-		if (kind !== null) {
-			const body = { seededAt: this.now() };
-			const data = backupOrchestratorRecordKinds["seed-markers"].schema.parse(body);
-			await kind.put({
-				id: seedId,
-				data
-			});
-			return;
-		}
-		await this.store.insert({
-			collection: BACKUP_SEED_MARKERS_COLLECTION,
-			record: {
-				id: seedId,
-				data: {
-					seed_id: seedId,
-					seeded_at: this.now()
-				}
-			}
-		});
-	}
-};
-//#endregion
-//#region src/builtins/backup-orchestrator/record-kinds.ts
-var BACKUP_SCHEDULES_LEGACY = "backup_schedules";
-var BACKUP_DESTINATION_POLICIES_LEGACY = "backup_destination_policies";
-var BackupScheduleBodySchema = z.object({
-	label: z.string(),
-	cron: z.string(),
-	enabled: z.boolean(),
-	locationIds: z.array(z.string()).readonly(),
-	retentionCount: z.number(),
-	dataSources: z.array(z.string()).readonly().optional(),
-	databases: z.array(DataStoreDatabaseSchema).readonly().optional(),
-	lastAttemptAt: z.number().optional(),
-	lastSuccessAt: z.number().optional(),
-	lastError: z.string().optional()
-});
-var BackupDestinationPolicyBodySchema = z.object({
-	enabled: z.boolean(),
-	retentionCount: z.number(),
-	label: z.string().optional(),
-	lastAttemptAt: z.number().optional(),
-	lastError: z.string().optional()
-});
-var BackupEncryptionKeyBodySchema = z.object({
-	keyId: z.string(),
-	publicKey: z.string(),
-	createdAt: z.number(),
-	retiredAt: z.number().nullable()
-});
-var BackupSeedMarkerBodySchema = z.object({ seededAt: z.number() });
-var _backupOrchestratorRecordKinds = defineRecordKinds({
-	schedules: {
-		schema: BackupScheduleBodySchema,
-		class: "config",
-		writeTrigger: "operator upsert/delete; orchestrator stamps lastAttempt/success/error",
-		device: "none",
-		at: "none",
-		indexes: [{
-			name: "enabled",
-			fields: ["enabled"]
-		}],
-		retention: { none: "operator delete only" },
-		adoptsFrom: BACKUP_SCHEDULES_LEGACY,
-		entry: {
-			title: "Backup schedules",
-			nameField: "label"
-		}
-	},
-	"destination-policies": {
-		schema: BackupDestinationPolicyBodySchema,
-		class: "config",
-		writeTrigger: "ensureDefault, operator upsert, recordAttempt after each archive write",
-		device: "none",
-		at: "none",
-		retention: { none: "row outlives location; ensureDefault recreates" },
-		adoptsFrom: BACKUP_DESTINATION_POLICIES_LEGACY
-	},
-	"encryption-keys": {
-		schema: BackupEncryptionKeyBodySchema,
-		class: "config",
-		writeTrigger: "setupEncryption activate; disableEncryption retires active row",
-		device: "none",
-		at: "none",
-		retention: { none: "retired keys kept for archive decryption hints" },
-		adoptsFrom: BACKUP_ENCRYPTION_KEYS_COLLECTION
-	},
-	"seed-markers": {
-		schema: BackupSeedMarkerBodySchema,
-		class: "config",
-		writeTrigger: "mark() once per seed id after seed landed",
-		device: "none",
-		at: "none",
-		retention: { none: "one row per seed id ever" },
-		adoptsFrom: BACKUP_SEED_MARKERS_COLLECTION
-	}
-});
-var backupOrchestratorRecordKinds = _backupOrchestratorRecordKinds;
-var backupSchedulesRecordKind = _backupOrchestratorRecordKinds.schedules;
-var backupDestinationPoliciesRecordKind = _backupOrchestratorRecordKinds["destination-policies"];
-var backupEncryptionKeysRecordKind = _backupOrchestratorRecordKinds["encryption-keys"];
-var backupSeedMarkersRecordKind = _backupOrchestratorRecordKinds["seed-markers"];
-function backupRecordStoresOf(records) {
-	return {
-		schedules: records.kind(backupSchedulesRecordKind),
-		destinationPolicies: records.kind(backupDestinationPoliciesRecordKind),
-		encryptionKeys: records.kind(backupEncryptionKeysRecordKind),
-		seedMarkers: records.kind(backupSeedMarkersRecordKind)
-	};
-}
-//#endregion
 //#region node_modules/tar/dist/esm/index.min.js
 var Mr = Object.defineProperty;
 var Br = (s, t) => {
@@ -4457,4 +4210,4 @@ async function prepareRestoreArchive(input) {
 	}
 }
 //#endregion
-export { parseBackupSecretKey as _, BackupSnapshotRefusedError as a, backupOrchestratorRecordKinds as c, BackupEncryptionKeyStore as d, BackupDecryptError as f, generateBackupKeyPair as g, ENCRYPTED_BACKUP_SUFFIX as h, BackupCancelledError as i, backupRecordStoresOf as l, BackupKeyMismatchError as m, precheckRestoreKey as n, DEFAULT_BACKUP_DATABASES as o, BackupKeyFormatError as p, prepareRestoreArchive as r, SystemBackupService as s, BackupKeyRequiredError as t, BackupSeedMarkerStore as u, readBackupEncryptionHeader as v };
+export { backupRecordStoresOf as _, BackupSnapshotRefusedError as a, BackupDecryptError as c, ENCRYPTED_BACKUP_SUFFIX as d, generateBackupKeyPair as f, backupOrchestratorRecordKinds as g, readBackupEncryptionHeader as h, BackupCancelledError as i, BackupKeyFormatError as l, parseBackupSecretKey as m, precheckRestoreKey as n, DEFAULT_BACKUP_DATABASES as o, parseBackupPublicKey as p, prepareRestoreArchive as r, SystemBackupService as s, BackupKeyRequiredError as t, BackupKeyMismatchError as u };